CVE-2024-38140: Windows 10 1507 RMCAST RCE Vulnerability

CVE-2024-38140 Overview

CVE-2024-38140 is a critical remote code execution vulnerability in the Windows Reliable Multicast Transport Driver (RMCAST). This kernel-level driver handles Pragmatic General Multicast (PGM) protocol operations for reliable multicast data delivery. The vulnerability allows unauthenticated remote attackers to execute arbitrary code in kernel context by sending specially crafted network packets to systems with the MSMQ (Microsoft Message Queuing) service enabled.

Critical Impact

Remote attackers can achieve full system compromise through network-based exploitation without requiring authentication or user interaction, potentially leading to complete takeover of affected Windows systems.

Affected Products

• Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
• Microsoft Windows 11 (versions 21H2, 22H2, 23H2, 24H2)
• Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2

Discovery Timeline

• August 13, 2024 - CVE-2024-38140 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2024-38140

Vulnerability Analysis

The vulnerability resides in the RMCAST driver (rmcast.sys), a kernel-mode component responsible for implementing the Pragmatic General Multicast (PGM) protocol used by Microsoft Message Queuing (MSMQ) for reliable multicast communications. The flaw is classified as a Use After Free (CWE-416) vulnerability, where the driver improperly handles memory objects during packet processing.

When processing specially crafted PGM packets, the driver fails to properly manage object lifetimes, resulting in a use-after-free condition. This allows an attacker to manipulate freed memory and potentially execute arbitrary code with kernel-level privileges. The vulnerability is particularly dangerous because it operates at the driver level, providing attackers with the highest system privileges upon successful exploitation.

Systems are vulnerable when the MSMQ service is installed and running, which enables PGM protocol support. This service is commonly deployed in enterprise environments for reliable message delivery between applications.

Root Cause

The root cause is a use-after-free vulnerability (CWE-416) in the RMCAST driver's packet processing logic. The driver references a memory object after it has been freed, creating a window for attackers to corrupt memory and gain code execution. This occurs due to improper synchronization or reference counting in the handling of multicast transport data structures.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying target systems with the MSMQ service enabled (listening on PGM multicast ports)
2. Crafting malicious PGM protocol packets designed to trigger the use-after-free condition
3. Sending these packets over the network to the vulnerable system
4. Achieving kernel-level code execution when the freed memory is accessed with attacker-controlled data

The exploitation occurs entirely over the network, making it particularly dangerous in environments where MSMQ services are exposed. Successful exploitation grants the attacker SYSTEM-level privileges, enabling complete compromise of the affected host.

Detection Methods for CVE-2024-38140

Indicators of Compromise

• Unexpected crashes or blue screens (BSOD) related to rmcast.sys driver
• Anomalous PGM/multicast traffic patterns on the network targeting MSMQ ports
• Unusual kernel-mode activity or memory corruption signatures in crash dumps
• Suspicious processes spawned with SYSTEM privileges following network activity

Detection Strategies

• Monitor for unusual traffic targeting PGM multicast addresses and MSMQ service ports (typically TCP 1801 and multicast ports)
• Deploy network intrusion detection signatures for malformed PGM protocol packets
• Enable Windows Event Logging for MSMQ service and kernel driver events
• Implement endpoint detection rules for rmcast.sys crash events or abnormal behavior

Monitoring Recommendations

• Enable kernel crash dump collection to aid forensic analysis of potential exploitation attempts
• Monitor MSMQ service status and configuration changes across the environment
• Implement network segmentation to limit exposure of MSMQ services to untrusted networks
• Use SentinelOne's kernel-level behavioral monitoring to detect post-exploitation activities

How to Mitigate CVE-2024-38140

Immediate Actions Required

• Apply Microsoft's August 2024 security updates immediately to all affected systems
• Disable the MSMQ service on systems where it is not required
• Implement network segmentation to restrict access to MSMQ services from untrusted networks
• Review firewall rules to block PGM multicast traffic from external sources

Patch Information

Microsoft has released security patches addressing this vulnerability as part of the August 2024 Patch Tuesday updates. The patches are available through Windows Update, WSUS, and the Microsoft Update Catalog. Organizations should prioritize patching given the network-exploitable nature and critical severity of this vulnerability. For detailed patch information and specific KB articles for each affected product, refer to the Microsoft Security Update Guide for CVE-2024-38140.

Workarounds

• Disable the MSMQ service if not required: Stop-Service MSMQ; Set-Service MSMQ -StartupType Disabled
• Block PGM multicast traffic at network perimeters and internal firewalls
• Use Windows Firewall to restrict inbound connections to the MSMQ service
• Consider disabling the PGM protocol specifically if MSMQ functionality is still needed without multicast support

# Disable MSMQ service (PowerShell)
Stop-Service -Name MSMQ -Force
Set-Service -Name MSMQ -StartupType Disabled

# Verify service is disabled
Get-Service -Name MSMQ | Select-Object Name, Status, StartType